@code-recycle/cli — Greenflagged

高级语法查询替换工具;Advanced syntax query replacement tool

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

wszgrcy

Keywords

ast querycss selectorparserparser bundlefindreplace@lezertree-sitterantlr4vueangularjsonc-parserpgsql-ast-parserhtmlparser2searchreplacelike

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
semgrep	semgrep:base64-decode	AI (semgrep): YAML binary tag handler in bundled yaml library.	ai	2026/05/31
semgrep	semgrep:new-function-constructor	AI (semgrep): Bundled ajv schema compiler; standard pattern.	ai	2026/05/31
semgrep	semgrep:env-bulk-read	AI (semgrep): Bundled debug library reading DEBUG_ env vars.	ai	2026/05/31
semgrep	semgrep:api-obfuscation-reflect	AI (semgrep): Angular devkit workspace proxy pattern; not obfuscation.	ai	2026/05/31
phantom-deps	phantom-dep:@angular/core	AI (phantom-deps): Framework-scoped dep loaded by convention; stable false positive for this package.	ai	2026/05/30
phantom-deps	phantom-dep:zone.js	AI (phantom-deps): Angular peer dep loaded by convention alongside @angular/core; not a direct import by design.	ai	2026/05/30
phantom-deps	phantom-dep:@types/lodash	AI (phantom-deps): Type-only package; never directly imported at runtime.	ai	2026/05/30
typosquat	typosquat.levenshtein:joi	AI (typosquat): Scoped package @code-recycle/cli has no plausible relationship to joi; edit-distance match is a false positive for this long scoped name.	ai	2026/04/26
semgrep	semgrep:child-process-import	AI (semgrep): Expected for a CLI tool; no evidence of malicious use — import appears in standard Node.js built-in module mapping in webpack bundle.	ai	2026/04/26
semgrep	semgrep:eval-usage	AI (semgrep): Fires in YAML parsing section of webpack bundle; consistent with YAML JS function tag support, not arbitrary code injection.	ai	2026/04/26
semgrep	semgrep:dynamic-require	AI (semgrep): Fires on webpack bundle infrastructure and intentional hot-reload of user scripts (delete require.cache pattern); consistent with CLI tool's documented purpose.	ai	2026/04/26

Versions (showing 4 of 4)

Version	Deps	Published
1.3.14	29 / 0	2026-05-26
1.3.13	29 / 0	2026-04-25
1.3.12	28 / 0	2026-04-25
1.3.11	27 / 0	2026-04-25

v1.3.14

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v1.3.13

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.12

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v1.3.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.